11917

Maarut; Toronto; On-site; CAD 90,000 - 120,000; Full time

Job summary

Maarut is seeking a Senior PIA Specialist to lead privacy impact assessments for new technologies and programs. You will evaluate compliance with privacy laws, guide risk mitigations, and address client concerns while coordinating with legal, security, and business teams.

The role requires deep knowledge of FIPPA, PHIPA, PIPEDA and experience in public/private sector privacy projects. Strong communication and reporting skills are essential for executive stakeholders.

Qualifications

• Experienced with privacy legislation (FIPPA, PHIPA, PIPEDA).
• Experience conducting PIAs and privacy risk assessments for various platforms.
• Ability to lead and consult across multi-disciplinary teams (technical, legal, business).
• Strong documentation, reporting and presentation skills for senior management.

Responsibilities

• Lead and support development of privacy impact assessment reports tailored to audiences.
• Provide consultative advice on laws, regulations, and privacy controls.
• Coordinate inputs across technical, legal, security, and business teams to identify gaps and mitigations.
• Develop risk-based recommendations and action plans for business owners.

Skills

Privacy concepts

Regulatory knowledge

PIA methodology

Data flows mapping

Communication with stakeholders

Risk assessment

Policy development

Strong writing skills

Project leadership

Information management lifecycle

Education

Professional certification (IT security/architecture)

Job description

RQ11837 - Privacy Impact Assessment (PIA) Specialist - Senior

• Required to lead and support the development of a Privacy ImpactAssessment (PIA) report, which evaluates whether new technologies, informationsystems or proposed programs and policies meet legal and privacy requirements,determines and guides risk mitigations, and addresses clients’ concerns.
  
• These requirements include ensuring program compliance withapplicable privacy statutes (provincial, federal, or municipal) and privatesector access and privacy legislation, as well as relevant regulations, programstatutes, OPS policies, Management Board of Cabinet Directives, standards,guidelines and internationally established Fair Information Principles andindustry best practices.
  
• Following several methodologies (PIA methodology, businessanalysis, risk analysis principles, information management lifecycle) toprepare in-depth report(s) tailored to the target audience (e.g., PrivacyImpact Assessment Report, briefing notes for senior management) that analysesexisting and proposed policies, programs and technical upgrades for gaps, risksand impacts on an individual’s personal information and privacy controls.Findings and recommendations for action are identified for business owners toconsider and action.
  
• Provides consultative advice, guidance and approaches onlaws, regulations, policies, standards, or procedures to clusters &ministries, management, personnel, or key groups. May involve work with otherjurisdictions and the broader public sector.
  

General Skills

• Excellent knowledge of privacy and security concepts,trends, and issues. This includes an understanding of their impact on businessprocesses, as well as ability to interpret, apply and communicate applicableprinciples and compliance requirements.
  
• Knowledge of, and experience in researching and applyingrelevant information privacy and access laws, regulations, jurisprudence(particularly as it relates to the Information and Privacy Commissioner ofOntario) and risk countermeasures and mitigation strategies
  
• Experience conducting privacy assessments involving personalinformation in a public sector context
  
• Knowledge of, and experience with mapping data flows andproviding advice on privacy approaches, privacy enhancing best practices andpotential mitigation strategies for consideration by business owners andclients.
  
• Knowledge and ability to interpret and apply Ontario’sFreedom of Information and Protection of Privacy Act (FIPPA) and its municipalequivalent the Municipal Freedom of Information and Protection of Privacy Act(MFIPPA), Personal Health Information Protection Act (PHIPA) their respectiveregulations and related jurisprudence
  
• Familiarity with federal Personal Information Protection andElectronic Documents Act (PIPEDA) and US PATRIOT Act, plus any other laws andregulations as applicable
  
• Policy Knowledge
  
• Familiarity with OPS Privacy Impact Assessment Process andTools released by the Ontario Ministry of Government Services;
  
• Familiarity with OPS Corporate Policy on RecordkeepingAccess and Privacy
  
• Good understanding of related disciplines, such as ITsecurity, IT system design, policy development (privacy or security), businessand security architecture, encryption methods, legal processes, Freedom ofInformation administration, business analysis, risk management, projectmanagement.
  
• Operational Program and Business Design Skills
  
• Ability to lead, mange or support the development of a PIAeither independently or as part of a team by consulting, negotiating andmediating across diverse subject matter expert groups (e.g., technical,business, legal, security, accessibility) within the organization to gather andcoordinate inputs and feedbacks.
  
• Knowledge and ability to create and understand data flowdiagrams and business process diagrams
  
• Ability to recognize the need for, and seek input fromexternal experts as required
  
• Excellent communication skills with technical and businessaudiences and non-technical access and privacy experts
  
• Technology and Systems Knowledge
  
• Analytical skills to understand the current and futureaccess and privacy implications of policies, decisions, business initiativesand industry trends
  
• Analytical skills to understand how data moves betweensystems and where personal information is exposed or stored
  
• Knowledge of Information Technology concepts and processesthat impact the protection of personal information, including (but not limitedto) Internet tools, system interfaces, encryption standards and methods,information security, information architecture and data flows.
  
• The work may span across legacy systems, digital and backendsystems, web applications, cloud-based solutions and platforms, and third-partyservice provider integrations.
  
• Information and Records Management and AccessibilityKnowledge
  
• Experience in developing risk assessment tools,methodologies, policies and procedures to effectively manage personalinformation
  
• Knowledge of policies, directives, standards, businessrules, procedures and guidelines relating to records management includingclassification, retention and disposition of information
  
• Knowledge and understanding of Accessibility for Ontarianswith Disability Act (AODA) and related regulations and standards
  
• Professional certification from a related discipline, suchas IT security, architecture
  
• Experience providing education and training related toprivacy
  
• Knowledge of, and experience with the policies andprocedures of the Ontario government (e.g. business case development , projectapprovals and policy development)
  

Requirements

Experience and Skill Set Requirements

Must Haves

• Experienced in privacy legislation including Freedom ofInformation and Protection of Privacy Act (FIPPA), Personal Health InformationProtection Act (PHIPA), the Personal Information Protection and ElectronicDocuments Act (PIPEDA)
  
• Experienced working with policy development teams;reviewing and comparing policies and legislation to make informedrecommendations to ensure adequate privacy protections and considerations areaddressed within policy/legislation.
  
• Experience with privacy risks and conducting PIAs and theunique security and privacy challenges associated with various platforms.
  
• Experience with privacy risks and conducting PIAsassociated with integration between legacy systems, web applications, digitaland cloud-based solutions to obtain, retrieve and synchronize information.
  
• Demonstrated strong communication and engagement skillswith ability to lead teams in discovery sessions to elicit details of technicalsolutions, business processes and/or policies, strong writing skills todocument findings, recommendation, etc.
  

Nice to have

• OPSexperience
  

Skill Set Requirements

• Experienced in privacy legislation including Freedom ofInformation and Protection of Privacy Act (FIPPA), Personal Health InformationProtection Act (PHIPA), the Personal Information Protection and ElectronicDocuments Act (PIPEDA)
  
• Experienced in conducting privacy assessments involvingpersonal information, citing examples in resume.
  
• Experienced in leading and conducting privacy assessmentswith involving online and/or digital solutions.
  
• Lead and conducted assessments involving personal healthinformation involving third party solutions (e.g. private sector or non-profitapplication solutions) and/or service integration providers.
  
• Experienced working with policy development teams; reviewingand comparing policies and legislation to make informed recommendations toensure adequate privacy protections and considerations are addressed withinpolicy/legislation.
  
• Experience with privacy risks and conducting PIAs and theunique security and privacy challenges associated with various platforms.
  
• Demonstrated experience and familiarity with strongsecurity, encryption and privacy protection approaches to digital solutions,including web based and backend integrations via API or similar approaches.
  
• Experience with privacy risks and conducting PIAs associatedwith integration between legacy systems, web applications, digital andcloud-based solutions to obtain, retrieve and synchronize information.
  
• Familiar with cloud-based technologies including thesecurity and privacy considerations, limitations, and best practices for dataprotection.
  
• Experience, knowledge and understanding of privacyprotection standards and best practices, business, information and securityarchitecture principles and emerging technology related to the protection ofprivacy and personal information.
  

Leadership and Communications

• Demonstrated strong communication and engagement skills withability to lead teams in discovery sessions to elicit details of technicalsolutions, business processes and/or policies, strong writing skills todocument findings, recommendation, etc.
  
• Demonstrated ability to interpret both technical (e.g.architecture design documents, process flows, state transition diagrams, etc.)and non-technical documentation to trace how data and systems behave acrossdifferent user scenarios, to conduct assessment of impacts and to developmitigation strategies.
  
• Strong organizational and time management skills to managemultiple and concurrent requests in an agile and highly dynamic workenvironment setting.
  
• Strong presentation abilities to communicate findings,recommendations, etc. to senior management and executives to inform decisionmaking; able to communicate complex problems/issues in simple terms.
  

Digital Identity Frameworks and Standards

• Experience in developing, applying and/or evaluating digitalidentity trust frameworks.
  

OPS experience

• Prior experience with leading and conducting multiple PIAsin OPS setting/ environment, including demonstrated knowledge and experiencewith OPS processes, existing templates and expectations to obtain approvals/signoff